What does FINRA Regulatory Notice 24-09 say about AI in banking?

What are the key points of FINRA Regulatory Notice 24-09?

• Scope: Gen AI and LLM tools; FINRA says its rules 'are intended to be technology neutral' and apply to AI as to any other technology.
• The Notice 'does not create new legal or regulatory requirements or new interpretations of existing requirements' and does not relieve firms of existing obligations under the federal securities laws.
• Rule 3110 (Supervision): a firm must have a reasonably designed supervisory system tailored to its business; if Gen AI is used within the supervisory system (for example to review electronic correspondence), policies should address technology governance, including model risk management, data privacy and integrity, and reliability and accuracy of the model.
• Rule 2210 (Communications with the Public): the content standards apply whether communications are generated by a human or a technology tool; FINRA points to its advertising FAQs B.4 (supervising chatbot communications) and D.8 (AI-created communications).
• FINRA rules apply whether a firm develops Gen AI tools itself or uses a third party's, 'including through embedded features in existing third-party products'.
• Firms should evaluate Gen AI tools before deploying them and ensure they can keep complying with FINRA rules; FINRA 'will consider issuing further guidance' on particular rules for specific use cases.
• Concerns listed: accuracy, privacy, bias, intellectual property and exploitation by threat actors.
• Engagement routes: interpretive requests, discussions with the firm's Risk Monitoring Analyst, and written feedback to FINRA on how rules might be modernized for Gen AI (email with 'Gen AI' in the subject).

What did FINRA Regulatory Notice 24-09 change for banks?

The notice put member firms on record that generative AI sits inside existing supervision, communications and recordkeeping obligations rather than outside them, and it opened a channel for rule-modernization feedback. It is the baseline that FINRA's 2026 Annual Regulatory Oversight Report and the July 2026 Rule 2210 modernization proposal (Regulatory Notice 26-14) build on.

What does FINRA Regulatory Notice 24-09 require of broker-dealers using generative AI, including bank-owned ones?

FINRA Regulatory Notice 24-09 requires nothing new: it says it creates no new legal or regulatory requirements, and instead reminds member firms that FINRA's technology-neutral rules apply to generative AI as to any technology. The two rules it spotlights are Rule 3110, which requires a reasonably designed supervisory system whose policies, if Gen AI is used in supervision, should address technology governance, model risk management, data privacy and integrity, and reliability and accuracy, and Rule 2210, whose communications content standards apply whether a human or a tool wrote the message. The rules apply to tools a firm builds and to third-party tools, including embedded features, and firms should evaluate tools before deployment. Banks are not FINRA members; the notice applies to a bank's registered broker-dealer affiliates.

Regulatory Notice 24-09 is a reminder, not a rule. FINRA says plainly that it creates no new requirements and no new interpretations, and that firms remain bound by the same securities-law and FINRA obligations they had before. The notice's value is in naming the hooks: Rule 3110 supervision, with model risk management, data privacy and integrity, reliability and accuracy listed as governance topics when Gen AI is part of the supervisory system, and Rule 2210 communications, where FINRA's earlier advertising FAQs already address chatbot and AI-created communications.

For a bank group, the notice is relevant to the registered broker-dealer, not the bank. A bank-owned broker-dealer using a vendor's Gen AI assistant to draft client communications or summarise research needs the Rule 3110 supervisory procedures and Rule 2210 review to cover it, including embedded features in existing products. The same group will also have bank-side model risk expectations from the Federal Reserve or OCC; the FINRA notice does not replace them, and they do not replace FINRA's.

The notice sits at the start of FINRA's AI sequence. The 2026 Annual Regulatory Oversight Report extended it with a GenAI section and AI agents, and the July 2026 Regulatory Notice 26-14 proposes to modernize Rule 2210 citing advances in generative AI. Like the IOSCO supervisory toolkit, FINRA uses existing rules rather than writing AI-specific ones.

WHAT THIS MEANS IN PRACTICE

• Map every Gen AI use in the broker-dealer, including features embedded in vendor products, to the supervisory procedures under Rule 3110.
• Apply Rule 2210 review to AI-generated retail and institutional communications; AI authorship does not change the content standards.
• Document pre-deployment evaluation of each Gen AI tool and the ability to keep complying with FINRA rules.
• Address model risk management, data privacy and integrity, and reliability and accuracy in the AI governance policies for any Gen AI used in supervision, such as correspondence review.
• Keep bank-side model risk and third-party governance aligned with the broker-dealer's, but do not assume bank-level approval satisfies FINRA's rules.